Page-template resolution is the WordPress core logic that decides which theme template file should be loaded for a page request. It evaluates the requested content, theme hierarchy, and template naming rules to pick the PHP file that renders the page.
This matters in security because template selection is file handling, and file handling is a common attack surface. If an attacker can influence the path or name used during resolution, they may push WordPress toward an unintended local PHP file, creating a path traversal or file inclusion risk. In real attacks, defenders look for unsafe theme layouts, writable directories, and server settings that make local files reachable. In defense, keeping WordPress updated, using well-structured themes, and limiting access to sensitive PHP files helps reduce the chance that template logic becomes code execution.